‼ CVE-2023-1668 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24721 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary web scripts or HTML.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26467 ‼
📖 Read
via "National Vulnerability Database".
A man in the middle can redirect traffic to a malicious server in a compromised configuration.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1916 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.📖 Read
via "National Vulnerability Database".
🕴 Renewed Focus on Incident Response Brings New Competitors and Partnerships 🕴
📖 Read
via "Dark Reading".
Microsoft and others are doubling down on incident response, adding services and integrating programs to make security analysts and IR engagements more efficient.📖 Read
via "Dark Reading".
Dark Reading
Renewed Focus on Incident Response Brings New Competitors and Partnerships
Microsoft and others are doubling down on incident response, adding services and integrating programs to make security analysts and incident response engagements more efficient.
‼ CVE-2023-1903 ‼
📖 Read
via "National Vulnerability Database".
SAP HCM Fiori App My Forms (Fiori 2.0) - version 605, does not perform necessary authorization checks for an authenticated user exposing the restricted header data.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29112 ‼
📖 Read
via "National Vulnerability Database".
The SAP Application Interface (Message Monitoring) - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29108 ‼
📖 Read
via "National Vulnerability Database".
The IP filter in ABAP Platform and SAP Web Dispatcher - versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89, 7.91, may be vulnerable by erroneous IP netmask handling. This may enable access to backend applications from unwanted sources.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29111 ‼
📖 Read
via "National Vulnerability Database".
The SAP AIF (ODATA service) - versions 755, 756, discloses more detailed information than is required. An authorized attacker can use the collected information possibly to exploit the component. As a result, an attacker can cause a low impact on the confidentiality of the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29186 ‼
📖 Read
via "National Vulnerability Database".
In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (administrative) privileges then potentially critical OS files can be overwritten making the system unavailable.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28765 ‼
📖 Read
via "National Vulnerability Database".
An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depending on the privileges of the BI user, the attacker can perform operations that can completely compromise the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27897 ‼
📖 Read
via "National Vulnerability Database".
In SAP CRM - versions 700, 701, 702, 712, 713, an attacker who is authenticated with a non-administrative role and a common remote execution authorization can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform. Depending on the function executed, the attack can can have limited impact on confidentiality and integrity of non-critical user or application data and application availability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27267 ‼
📖 Read
via "National Vulnerability Database".
Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27497 ‼
📖 Read
via "National Vulnerability Database".
Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute malicious scripts on all connected Diagnostics Agents running on Windows. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29187 ‼
📖 Read
via "National Vulnerability Database".
A Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup (Software Installation Program) - version 9.0, resulting in a privilege escalation running code as administrator of the very same Windows PC. A successful attack depends on various preconditions beyond the attackers control.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27191 ‼
📖 Read
via "National Vulnerability Database".
An issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the SharedPreference files.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28763 ‼
📖 Read
via "National Vulnerability Database".
SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters which can consume the server's resources sufficiently to make it unavailable over the network without any user interaction.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43293 ‼
📖 Read
via "National Vulnerability Database".
Wacom Driver 6.3.46-1 for Windows was discovered to contain an arbitrary file write vulnerability via the component \Wacom\Wacom_Tablet.exe.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29109 ‼
📖 Read
via "National Vulnerability Database".
The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows an Excel formula injection. An authorized attacker can inject arbitrary Excel formulas into fields like the Tooltip of the Custom Hints List. Once the victim opens the downloaded Excel document, the formula will be executed. As a result, an attacker can cause limited impact on the confidentiality and integrity of the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29189 ‼
📖 Read
via "National Vulnerability Database".
SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to modify HTTP verbs used in requests to the web server. This application is exposed over the network and successful exploitation can lead to exposure of form fields📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29185 ‼
📖 Read
via "National Vulnerability Database".
SAP NetWeaver AS for ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters in certain circumstances which can consume the server's resources sufficiently to make it unavailable over the network without any user interaction.📖 Read
via "National Vulnerability Database".